![Page 1: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/1.jpg)
Keep your device to yourself
Per Thorsheim Security Advisor God Praksis
Twitter: @thorsheim
![Page 2: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/2.jpg)
Background 24.01.13: Trend Micro reports that 60% of
working Norwegian have use a personal smartphone, PC or pad to handle work-related
information.
My chronicle at Computerworld, 25.01.2013: «Hold dingsen din for deg selv»
…And articles in Advokatbladet Sept 2011 & April 2012
![Page 3: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/3.jpg)
Definitions Bring Your Own Device - BYOD
o «Use your own equipment to do your job»
Mobile Device Management – MDM o Software for controlling mobile devices
• Tracking, remote deletion, maintenance, control, limitations
![Page 4: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/4.jpg)
Devices get:
Damaged (?)
Lost (?)
Stolen! No reporting to police
Not found again
Not returned or destroyed
Launch of new iPhone model Damaged / lost / stolen iPhone
![Page 5: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/5.jpg)
Organisation:
Support CSO Bad Guy Auditor
Ola
I want to do my job fast, correct and easy.
Kari
I want Internet access, and all the tools I need to do
my job.
Organisation X
My way, or no way…
«Need»?
![Page 6: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/6.jpg)
What do you have on your iPad? Apple / iTunes konto Gmail + IMAP mail Twitter, Facebook Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass
News, Spotify, LastPass Vine, BankID, Kindle
Digipost, iZettle, Evernote Finn iPhone
WolframAlpha, FINN.no Bergen Taxi, Instagram
Bank app
Red = §Personally sensitive info and/or financial risk
+ config, usrnames & pwds for: VPN, WLAN
Storage / Backup
Offers 2FA authentication Requires 2FA authentication
![Page 7: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/7.jpg)
Support Bad Guy
Ola
Kari
Organisation X
Exchange MDM
Auditor
Help, I’ve been hacked! (Lost /stolen equipment)
Bad Guy
![Page 8: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/8.jpg)
Mobile Device - Client Side Risk Usually a 4-digit PIN
o User selected PIN: Top100 used by «most» o Apple iOS: 4-digit PIN kan be cracked in <40 min
Device/memcard encryption not possible MDM often depends on being online (gsm/wifi)
Rockyou iPhone Physical access Control system
![Page 9: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/9.jpg)
Client – Server Comms Risk
(www.ssllabs.com – free check of SSL config on webservers)
![Page 10: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/10.jpg)
(Apple) Cloud Security
http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/ http://www.tv2.no/nyheter/innenriks/nakne-tenaaringsjenter-selges-paa-nett-3961421.html
Demo time.
![Page 11: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/11.jpg)
Server Side Risk: OWA
Free tools on the Internet has automation modules readily available.
![Page 12: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/12.jpg)
Norwegian Data Protection Authority: Right of access does not apply to equipment
that workers themselves own.
This means that the employer does not have legal access to documents stored in the employee's private equipment, even if this
equipment from time to time may be used for work-related activities.
www.datatilsynet.no/Global/05_regelverk/epostforskriften_merknader.pdf
![Page 13: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/13.jpg)
MDM Legal Access Employer can not: Obtain a list of:
o Apps o Catalog/file names o Document names
Read / change: o Documents o Pictures o Videos o Sound files
Employer can: Require PIN/Password Require encryption
Grey areas: Tracking Remote lock Remote wipe Config control (audit)
![Page 14: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/14.jpg)
Recommendations Employer buys & owns all equipment needed Written & acknowleged procedures for legal access 24x7 incident handling group (IRT)
o May include lock / wipe / delete Secure client-server communication
o No defaults, please! Good practice SSL/TLS config on server
o No defaults, please! Personal use of cloud services should be avoided for work-related info & tasks.
![Page 15: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/15.jpg)
Password stuff.
Per Thorsheim Security Advisor God Praksis
Twitter: @thorsheim
![Page 16: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/16.jpg)
PIN pads
(Somewhere not important) London Stansted airport
![Page 17: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/17.jpg)
PASSWORD PROFILING Figuring out your next password:
![Page 18: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/18.jpg)
Offensive profiling: Threatagent.com
http://drb0n3z.wordpress.com/2013/04/21/passision-new-wordlist-creation-tool/
![Page 19: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/19.jpg)
Defensive profiling: Linkedin
![Page 20: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/20.jpg)
Color words in Linkedin passwords
![Page 21: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/21.jpg)
Linkedin share price development
![Page 22: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/22.jpg)
Charsets & Keyspace Calculations 4 character groups:
o lowercase, UPPERCASE, 0-9, !»#%&/()=?`+ Unicode 6.0 has 109242 characters (!)
o Video: https://vimeo.com/48858289
Effect of password policies on keyspace reductions: http://openwall.info/wiki/john/policy
![Page 23: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/23.jpg)
![Page 24: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/24.jpg)
Operation «Face Factor» Unique opportunity 5000+ headshots Passwords, full name etc available Analyze!
![Page 25: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/25.jpg)
Categorization
Gender Glasses (Y/N) Hair color Facial hair
![Page 26: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/26.jpg)
… and the result?
Women prefer length. Men prefer variety (entropy). «Unix gurus» came in last.
![Page 27: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/27.jpg)
The Passwords^ conference 2012 archive: Passwords12.at.ifi.uio.no
Planning 2 conferences this year: o Las Vegas, end of July. CFP open until May 17. Operational perspective. See passwordscon.org
o Bergen, December. FRISC. Academic perspective.
![Page 28: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/28.jpg)
Robert Morris The three golden rules to ensure computer security are: 1. Do not own a computer; 2. Do not power it on; 3. And do not use it.
“Never underestimate the attention, risk, money and time that an opponent will put into reading traffic.”
![Page 29: Keep your device to yourself - FRISC · Google+, Linkedin Skype, Dropbox Google Drive Norwegian reiseapp SATS app, Netflix Sprout Social / Klout Norsk Tipping / Buypass News, Spotify,](https://reader033.vdocument.in/reader033/viewer/2022050605/5facccb43b83913d7b7ddd04/html5/thumbnails/29.jpg)
Thank You! Per Thorsheim securitynirvana.blogspot.com @thorsheim /GodPraksis /user/thorsheim per.thorsheim +47 90 99 92 59